CVE-2026-28570: WordPress Vavo Core plugin <= 2.3.0 - Local File Inclusion vulnerability

Q: Which deployments are exposed and what access does an attacker need?

Sites with the Vavo Core plugin at version 2.3.0 or earlier are affected. The issue is reachable over the network and does not require authentication or user interaction, although exploitation has high attack complexity.

Q: What is the potential impact and is a remediation version identified?

Successful exploitation can affect confidentiality, integrity, and availability at a high level. The supplied information does not identify a fixed version or workaround, so remediation details cannot be determined from this record.

Published Aug 18, 2026

Updated

Unauthenticated Local File Inclusion in Vavo Core <= 2.3.0 versions.

Affected Software

1 affected component

WordPress Vavo Core plugin<=2.3.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress Vavo Core plugin to a version that resolves this vulnerability.
Fixed in 2.3.0

Event History

Aug 18, 2026

CVE Published

via MITRE·01:59 PM

Data Sourced

via MITRE·01:59 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·02:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed and what access does an attacker need?

Sites with the Vavo Core plugin at version 2.3.0 or earlier are affected. The issue is reachable over the network and does not require authentication or user interaction, although exploitation has high attack complexity.

What is the potential impact and is a remediation version identified?